When an abnormality occurs in a vehicle, the engine or transmission transits to a limp home mode or transits to a mechanical fail-safe mode such as fixed gear position, and thus the vehicle can travel for a certain time. For example, an electronic control device for controlling the vehicle is programmed to control the vehicle at a fixed water temperature of 80° C. when a water temperature sensor breaks down. Further, an electronic control device for transmission gear shift control has a fail-safe mechanism for settling at a specific gear position when an abnormality occurs. For example, a 5-speed automatic transmission (denoted as AT below) has a mechanism in which the gear is fixed at fourth during abnormal stop of an electronic control device or at third during abnormal power supply voltage, but the fail-safe mode is different depending on a kind of the transmission.
In the electronic control device, a plurality of items of parameter information for determining a traveling state of the vehicle are input in the main CPU, and the main CPU monitors the traveling state of the vehicle on the basis of the parameter information, which is reflected on actuator control. For example, a solenoid is a transmission actuator, but the main CPU controls a current flowing in the solenoid while monitoring a vehicle speed or accelerator position, thereby performing gear shift control on the basis of the gear shift diagram of FIG. 1, and monitors a change in engine revolutions or a hydraulic pressure, thereby performing smooth gear shift.
Here, if the gear is fixed at third in the fail-safe mode in a transmission when an abnormality occurs in the main CPU, shift-up or shift-down to third is forcibly performed in all the traveling states other than third. At this time, even if the gear enters third at the start of traveling at first, the driver only feels poor acceleration, and the vehicle cannot suddenly accelerate or suddenly decelerate. However, if the gear is shifted to third while the vehicle is traveling downhill at second, the vehicle can accelerate though the driver does not intend. Therefore, a tilt state of the vehicle needs to be determined and the vehicle needs to be controlled to keep traveling downhill at second.
Further, in FIG. 1, if an abnormality occurs in the main CPU in a high-speed traveling state of fourth, vehicle speed of 80 km/h, and accelerator position of ⅛, the gear is forcibly shifted to third and sudden deceleration can occur due to the engine braking. Further, if a traveling state is of high accelerator position and so high engine revolutions, the gear is similarly shifted to third, which can cause sudden acceleration, or engine overload due to excessive revolutions. Thus, in any case, the traveling is kept at fourth, or the shift-down control from fourth to third needs to be performed while monitoring the vehicle speed or engine revolutions and determining a timing when it reaches a certain value or less.
However, the sub-CPU is low in arithmetic capability than the main CPU in the conventional electronic control device using the sub-CPU for monitoring the main CPU, and thus only simple control can be performed such as including an arithmetic result sent from the main CPU with a given value thereby to detect an abnormality in the main CPU and to reset the main CPU. Thus, even if the sub-CPU detects an abnormality in the main CPU, it cannot perform the arithmetic processing instead of the main CPU, the main CPU is reset by the sub-CPU, the electronic control of the actuator is stopped and the actuator transits to the operations in the fail-safe mode.
In this way, in the conventional electronic control device, when an abnormality is detected in the main CPU irrespective of a traveling state such as the vehicle is accelerating, decelerating, or traveling downhill, the sub-CPU resets the main CPU soon. While the actuator is transiting from the operation under control of the main CPU to the operation in the fail-safe mode, the smooth gear shift control, which has been performed so far on the basis of the hydraulic control or timing control by the electronic control device, is not performed, and thus the gear shift is forcibly performed with a rapid gear shift shock to the driver and a mechanical load can be imposed on the transmission.
Since higher control safety has been requested for the electronic control device in recent years, a sophisticated sub-CPU or multicore CPU having the equivalent performance to the main CPU is used thereby to temporarily do complicated arithmetic and perform actuator control of the main CPU even when abnormality occurs in the main CPU. For example, some control parameters (such as vehicle speed or engine revolutions) required for the arithmetic are previously monitored by the sub-CPU and the main CPU is reset when the main CPU is abnormal, while the arithmetic and actuator control are performed and the operations of the electronic control device can be continued until the main CPU recovers after being reset. Alternatively, the multicore CPU can similarly continue the operations by previously doing arithmetic in parallel even when an abnormality occurs in one core.
Japanese Patent Application Laid-Open No. 11-73203 (PTL 1) is one of background art in the field of the present technique. PTL 1 describes that “the sub-microcomputer continues to give a reset signal to the reset terminal of the main microcomputer when detecting an abnormality in the main microcomputer, and switches the I/O port to the output port thereby to output a drive signal to the drive circuit” (see Abstract). Further, Japanese Patent Application Laid-Open No. 2012-73748 (PTL 2) describes that “the first core performs the processing performed by the second core as the first alternative processing at lower loads than the second core performs, and the second core performs the processing performed by the first core as the second alternative processing at lower loads than the first core performs” in the multicore CPU.